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: FILTERING INCOMING E-MAIL 

The present invention 'relates to ah "access controller and method 
for controlling access|to a .^ta .store. Un iarticular, the invention 
relates to a method operable in a mail client and a mail client for 
filtering incoming e-mail^*' .^f:^f : ^f?^'V!j ' ! ! 

When an e-mail message "is— s 1 £nt;^ ; a--rceGiver ^can discover the 
sender's e-mail address from the information attached to the e-mail 
message. Thus, the receiver may .snH^r^iently send as many mails as the 
receiver wishes to the sender. T^e^xree^ijv'er may also inform someone else 
of the sender's e-mail address aud tSl'irtf parties may also do the same. 
Normally this wouldn't be a problem vSut there is an increasing amount of 
' 'unsolicited and useless 'Spem' mail which can choke in-boxes (in- folders) 
. - M^;ma)fe;; i* t.^ or important e-mail 

w . f roro.junkrjnail -.• < 

Accordingly, the present invention provides' an access controller as 
claimed* in claim 1 and a ;method**fbr "Controlling access as claimed ;in 
claim 16. • ~- t 

■ , j ~. : 

The invention enables the" sender; itoV control j the ability of 3rd 
parties *to successfully send -e-mail- or -to" erisbier 'the classification of 
real e-mail from unsolicited possibly junk-mail. > 

Embodiments of the iiiy^ntioh'Jwill now ,Se T described wfth reference 
to the accompanying drawings, in- which: — ■ — j - 

Figure 1 shows a* mail clienY"acc6rding to a preferred embodiment of 
the invention; ■ J " 1 ■ ■ i v ^ 

Figure 2 is a flow diagram illustrating the generation of a token 
ID field; and 

Figure 3 is a flow diagram illustrating processing on receipt of a 
message including a token. 

For the purposes of clarity of description, the term "sender" will 
be used in relation to a party which wishes to filter their e-mail by 
sending tokens, and the term "receiver" is used in relation to the party 
who obtains the sender's mail address - even though either party may at 
different times be sending or receiving messages. 



The invention is described in terms of a mail client, for example, 
Notes produced by Lotus Corporation or Exchange produced by Microsoft 



Corporation, the operation of which is well known and need not be 
described in detail to understand the invention. 

it ^is. sufficient to say that such maii^clients usually include an 
in-box or iii- folder" into which new mail messages arrive, . Figure i. The 
user is usually able to set up other folders or sub -folders into which 
related messages may be..,stored, ,and a Tr^sh ^f older, is, usually supplied 
into which the user places "documents ".which," are .to .be r deleted when the 
client is closed. An address book is also provided and this may hold any 
.number^of .eLtt^ibuts^othe^ than „am .e-mail address, . f o? v . example, proper 
name /..phone, number ^ ^st?#f ^i^feess.^t,??-,.. ic , . - v . v 

The invention is based on the ability of a sender's mail client 
(hereaf ter z;ef e?:red,to, a§ a, "sender;*?) , ; send ,to a ; receiver ^ s mail client 
(hereafter ref er;^ed t ^o ; as a,? receiver")., a r special ^oken which is simply 
a set of bits attached to or included in a message. The receiver then 
replies to^tl^is messag^ , or „ sends, later messages attaching the same token. 

Preferably, this is done seamlessly, by making, the token part of the 
e-mail message header which is preserved when the receiver responds to 
the original .message., e.g. .using some .existing standard, MIME -header for 
this purpose. 

~ If "this token _ is notTattached or;' included in a message received by 

the original sender^ ..then; the messagejis either.,' popped/deleted or marked 
unsolicited and, copied to , a relevant ..folder . If the^ token is attached 
then the token is preferably examined to see if it is a valid token. If 
the, token , is- valid, then, the, e:mail is accepted, i.e. copied to the in- 
folder, if not the. e- mail, is dropped or,. marked unsolicited and copied to 
some other relevant folder . _ . . - . - • - • . - 

Three preferred forms. of. valid, token are: 

1) A token which allows 1 e-mail to pass to the senders in-folder 
(a single-e-mail, token) 

2) A token which, allows up to n e-mails to pass to the senders in- 
folder (an n-e-mail token) 

3) A token which allows an unlimited number of e-mails to pass to 
the senders in-folder. (an unlimited -e-mail -token) . 

Tokens are created by the sender who owns the in-folder.. These 
tokens are sent to receivers who may wish to send e-mail to the sender. 
The sender decides what type of token a receiver should have, i.e. a 
single -e-mail -token, an n-e-mail -token or an unlimited -e-mail -token. 



3 



How Tokens are Generated 

A function is made available within a mail client which controls 
the sender's in- folder for generating tokens, in a preferred embodiment, 
5 the function uses: 

an array" P "holding's ~s"equehce % 6f ~pr lmes 1?$, 3 ;*5 ,'7 iTll . 7* ' wh^re 

10 " **' r v ~a'"va^iabie'X"whifei ii^Initialisia £6~'i c: ana ' which J is remembered by 

the in- folder which red£fvii s dp^ that 
it has generated. 

a* varialiie 0 i whii^^i£"iniS^ of : wh£ch equals 

15 7 the number of "Token-IDs '£eneVa'ted^'to : datef ~a^8 J v T ' f 

" a* variable' z whIdn H IhdI'c*at'es "£h : e nuitibfer of : to&en-IDs required, for 
a single-e-mail token z =1? for an n-e-mail token z = n ; for an 
" unlimited cT-mail "token z *=' -i/ 5 '"*" * ' * * A "~ " " ■ ~ 



20 



A "token " T feas field dlita types and naiftes kk f6ilows:^' J y yr 



String T. date, set to the current system date of generating system. 
String T . time set to tie current^ systeirf t'iSie of "'generating system. 
25 Integer^ t". id [z] '; ' a^ 

populated with] a" Token "ID to be given t6 el"" ± eceivef: . 4 w ~ ^ 

Figure 2' shows* a flow diagram for /the portion of * the" Junction for 
Calculating each element 'of the "array Tlidl'At step 10, z is set: for a 
30 single-e-mail token z' m 'l; for a n-e-mail token z =.n; for an unlimited 

e-mail token z = -1. z can be determined through interaction with a user 
who is sending a message ' or depending on the type of message (inter- 
organisation or to trusted destinations) some automation may be involved. 

35 The function then loops k=abs(z) times ie: once for a single or 

unlimited token; or n times for an n-e-mail- token, within the loop, at 
step 12, the array element T.id[k] is initially set to an i+kth prime 
number, i is incremented every time a token is allocated and so keeps 
track of which prime number in the array P is to be allocated next. At 

40 step 14, z is checked to determine if an unlimited-e-mail token is being 

generated. If so, then the prime token id sign is set to negative at step 
16. At step 18, the number X associated with the sender's in-folder is 
■ multiplied by the Token- id P[i+k] assigned at step 12. This allows the 
token- id assigned to be remembered. The function continues to loop for an 

45 n-e-mail token, whereas for a 1-e-mail token or an unlimited e-mail token 

the loop will stop and the function continues to step 20. 
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At step 20, the position i in infinite sequence P is incremented by 
J the number of tokens allocated in the loop, a digital signature, is used 
tp sigxi the token T, and the signed Token Ts is then encrypted. Tse, the 
token tr is .then ready to be sent _ to.a^receiyer. 

Token Management _ . ^ ^ ( 

The .is„sue .and ..re- issue. .of _ tokens^can be. made, very, easy. .from a user 
, . iiiterf^c^e. ^pq^int . .of .jiew ^..g^by^a s imgle ( mouse i: cl i ck ^pn^a mess age _ from a 
10 receiver or on the receivers e-mail address in an address. book. This 

action causes the senders mail client to generate a new token and send it 
(via e-m$ilX„tp .the,. receivers. e-mail acidress... These e-mails could have a 
.spe.ci$3L fprmat so,,that they are invisible' ^ e : mail .transactions that 
occur between e-mail clients and do not appear in the in- folders of any 
15 parties.. The receivers e-mail,. client then .interprets this eTiaail and 

extracts, .the tpken aut optically, associating^ the token with the sender 
... and ensuring that when .an- f -mail is addressed, to the sender that the 

...token .(or .at lea^t, one f .element of ,'an.n.-e:inaii> token), is always attached 
r ... . to the e-mail in . the agreed location, : . . . !. : 

7 " It^will be, seen that the exchange of tokens could preferably be a 

^r..~„. ^transaction in itself . The sender e-mail client A sends the token to the 
p receivers client B f B requests_A to confirm the tokeji (to g\iard against 
^.someone faking the senders address K A sends_ confirmation of token issue 
25 \ , to B' i. updates" its. client It. will be seen that aiiy' sucfi transaction 

which can be reasonably secure can be used. 

How Tokens are Authenticated . 

30 .... The sender . uses . the token Tse when the" receiver sends the . sender an 

e-mail,, ie the -receiver attaches,, the token to their e-mail message in 
order to get their e-mail . successfully . into the original senders in- 
f older * 

35 a second function is made available within the mail client which 

. controls the senders in -folder for authenticating tokens. Referring to 
Figure 3, when a token Tse is received by the original sender, the 
function decrypts the token and the signature checked to confirm that it 
has not been tampered with, step 22 . . oktoreceive is at this initial stage 

40 set to false. The T.date and T.Time fields are not immediately important 

but may be processed in variations of the preferred embodiment. 

Although not necessary, the receiver sends a token, of the same type 
as issued by the sender. This means that even though included in one 
45 message, the T.id field is an array of primes. As explained below, the 

authenticating function loops up to k=arraylen times to find an element 
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of T.id by which X is divisible. Thus, each time the sender receives a 
message from the receiver J 'k will be divided" by the next highest "prime 
number in the array (the lowest valid prime numSer) The token runs out 
when there are no further primes left in the array by which k'Ts 
divisible. This makes token management on a receiver client easier, 
because the receiver only needs to store the token^seht r by '"the "sender and 
send this back with any message being sent to the sender. The sender's 
authenticating function,' without heedihg~to worry" about previous messages 
from* the receiver , ' automatically determines " whether the '"message 'i's to be 



10 ~" allowed' "or 'not ". 



;? .is > 



" l " 'It' should' b^ hot'ea' that iiTibraer ; t6*"6df f eetiy^vWi'fV'V ^tok^n it is 
necessary" for the senders "'ih- folder J tb have t^emb^r^d'* t&e* mfitfb'er " 'X . 

15 : * iir A't step 24, th§" function checks" ir X"'is 'divisible by the 'kth 

element' of T.id'l if " the' teceivi't had^tfevldtisiy s : £fxt a response message, 
then X would previously"^ have 'Been divided' by' the token : lb sent out* with 
that "message* X would' therefore not b'e'divisible"'fey^ whart the "sender 
assume* s is, a re-sent T.id. It* should be 'sefen" that because 3f 'will'^bnly 

20 be divisible r by allocated prime numbers, if the message had arrived from 

* \ t ' a" fraudulent' 4 ' receiver who haS generated a' token with in extremely ^iarge 
' prime nui^er/ hoping "it had~not yet been allocated by* th€~send££;"X would 
stiil not be divis By" this number . ' Step 24 4Is6 checks "that the T. id 
is a' prime to ensure" some' other factor 'by' which X* might b£ divisible was 

25 ' "not used. If the" checic~ at * step " 24 " is ' pas sed7'^ then* oktoreceive is "set to 
true at step 26. "" * " " " ** " L " ' — 

At step 28, the function checks if~ an" uhlimited-£-miir tokeri is 
encountered by looking at the sign of the T.id. If not an unlimited 
30 * token, X is' divided by T.id[k], 6tep 30, Meaning thiS" token identifier 

cannot be used again. If T. id [k] '"is ah unlimited token, X remains' 
untdufched and so remains divisiblerby T*. id [k] for when future messages 
are received from the same source. 

35 It will be seen that for n- e-mail -tokens only one token at a time 

is consumed in this way allowing for n e-mails to be accepted just as all 
n token- ids are divided into X. 

If the function passes the loop, that is k will equal arraylen, 
40 oktoreceive will remain false and so the e-mail message is moved to an 

Unsolicited Folder or the e-mail is dropped entirely at step 32. If 
oktoreceive has been set to true, at step 34, the function breaks out of 
the loop and the e-mail is copied to the in-folder at step 36, before the 
function returns. 

45 
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It will be. seen that in order for the. preferred embodiment to work 
it. is necessary to. have a list of prime numbers or a prime number 
generator to- manufacture a prime number tqXen-id for all new tokens. The 
in -f older _which. .manufactures these tpken-i££. needs, to persistently store 
5 . the., product, yal:u£ & ^he variable YAltt£ .1 which indicates how many 

tok^nridjs have been .madeu. _ , &1 ^ . . , 

iwr ...It.is also- necessary t^test jif a Jtpken..- id .^s ^ ,B?.i?g§ number so a 
prime-number tester is also required. Some fast algorithms exist that 

10 - r 3fci.ll- prove su &uiober r :ta ^ e.g. 

0 . 9 , by ^al-ling^.^ts^uAct-iWv 3 : or- A&tyegg 3 iX c,Qu^d Jac| ^st^lished that 
a number is a prime to some high deg^^ qf. qpnfi^^^e. ; The invention does 
not absolutely require extreme rigour in testing if a number is prime. It 
is sufficient to say that the token- id cleanly divides ? into^the factor X 

15 and is, with high probability, prime. 



20 
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30 



35 



40 
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- ... , Due; to the^ possible size, o^ the. nvgnb.ers, special large number 
.-libraries are preferably employed .to implement the invention. These are 
, available ,co^ercially .and : some. aiferarieA are ayailab?.^ . f £S© • . ^ r _ 

. " ■ unlimited - e -mail : ; tokens. .can. ,_be revoked jat any: time .by . <*f v ** in * the 
> .factor X by the. token- id, originally js.e»t to the ^qeiver. J**? te this 

token- id has. . a negjatiye ^sign to indicate that it is '^.unlimited token, 

but -this. sign. .is simply .ignored durin^^division.. 

- -An informative: e -..mail. may be sent jto the rec^iv^r infp^min^ them of 
.. .failure: to reach the destination .in-.f older, or hpvTmany remaining e-mails 
: they can send with their n-e-mail - token. . ; i 

It will b,e seen that the invention has many applications:, 

to reduce Spam mail, only those in possession of a valid token can 
get e-mail .to an inrfolder. A user can send an e-maii to a 
commercial organisation and -allow them to send one reply but not 
allow them, to send subsequent unsolicited e-mail. (It is ppssible 
that the token could be copied to another party but still only one 
e-mail can successfully be sent regardless of how many copies are 
made . ) 

to limit e-mail traffic, for example, a computer support company 
may give clients a token for 100 e-mails. After this has been used 
they can buy another token. This scheme limits the use of e-mail by 
persons if they feel there is some accounting being carried out, or 
if they are being charged for using the resource, i.e. getting it 
to an in -box so that it can be read by the support company. 
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the invention could also be applied in distributed object based 
""' systems, whereby an oB'ject declines or accepts' requests on "it based 
on the validity* of a tbken. in fact/' the" invention is applicable to 
any nature' of tr^ahsadti^, "for example," ti'aiisafct Tons ori : a 'database 
5 - a cllenfgets a ^"icfeh which a 1 lib ws a^lffb ^ansactibii : on^y' on the 

database before it is required to ger ^rieirloien-; v&erevfet there 
is a need to remove unsolicited requests or control the amount of 
requ£s£s e Gn ^ V^sbtarce theh 3 "thisr s'ciMne- xfcm 1 cP be ^employed. 

10 ' ; '* Tri J £^ client : uses three 

6uB-"foldirI Vit^ft? the &^'taall rc lif- ^li^r Vc^4^^xniHc^^'of ^ * • 

NeW : Parties " ''-^ * : ° — : ' - — v* ? 07 * > 

When an e-mail arrives it- is examined by the token senders e-mail 
client J If it is hew e-'&aiT the token* recieivet will have 'as yet no 
token assigned and the e-mail will' be copied "i^'tno-' this- f dTaer. :: The sender 
then ' browses "this New 'Parties "FbldeV : and decidWs. if T they wish to receive 

20 , future correspondence from the receiver. If not then the receiver's mail 

. is deleted" 'from the neW*FoT<Jejr 'and "future ^ from the -received will 

be* dropped (their e-mail addf'ess "ii4~eds~ to' be remembered' and checked 
agaihst'all future incomiiig e-mails) . if the user wishes to receive e- 
mail from the receiver/ then * "they decide how Ifcuch v e -mail they arer . 

25 ^ prepared to receive from the receiver, i.e. one more e-mail, n e-mails or 

an unlimited nuinber of e-mail's! ahd hfcvin^ 1 made this decision with"-, a 
iimple mouse" click the relevant* token (ie a single e-mail aii ; n-e-mail or 
unlimited e-mail token) is : issued to the receiver (the -'fec^i vers -mail 
client can then receive the token, identify the nature of the e-mail and 

30 automatically include the token in trie address book for the" sender - 

token exchange management could be automated quite easily.) . All future 
e-mails from the receiver 1 must use the token if they are to make it into 
the user's in-folder at all. As soon as the token is assigned, then the 
receiver is also excluded from New Parties Folder. If the receiver 

35 subsequently sends an e-mail without a token then that e-mail is dropped. 

Bad Parties 

If an e-mail is received and it has an invalid token, e.g. a 
40 single-e-mail token that has already been used, and n-e-mail token that 

has been used for n+1 or more times, or any token that has been revoked 
by the in-folder owner, then that e-mail is dumped into this folder, it 
would be possible, if required, to re -assign new tokens to these 
receivers in a similar way to that described above in the 'New Parties' 
45 section. 
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Good Parties - r -. ■. . 

E-mails received* from parties which use good .tokens are copied into 
this folder. These represent those e-mails that are bona fide solicited 
e-mails. It is of course possible at any stage to revoke any n- token or 
unlimited token keys associated with e-mails from parties in this folder. 
All future e-mails using these revoked keys end up in the 'Bad Parties' 
folder. The revoking procedure is preferably done by a right mouse click 
selection on a message from such a party or that party's address in an 
address book or something similar and this will cause the revoking 
procedure to be activated (the prime numbers stored in the token be it N 
numbers for n-e-mail tokens or a single prime number in the case of 
unlimited-e-mail tokens are simply divided into X stored with the in- 
f older, thus rendering the e-mail -token to be immediately invalid) . 

Using this embodiment, it is possible to receive spam mail in the 
'New Parties' folder, but once it is marked down as not qualifying for a 
token it will not be received into the 'New Parties' folder again. This 
significantly limits the exposure to spam mail., 

Dropping of e-mails 

There are no assumptions made about how or when e-mails are 
dropped. Preferably, e-mails arriving without tokens into the new folder 
after a decision has been made to award a token or not are automatically 
dropped (i.e. deleted or copied to some archive). The 'Bad Parties' 
folder would preferably be archived at some interval although it is 
useful not to drop them immediately so as to allow the: in- folder owner to 
see the effects of expired or revoked tokens. 

Adding More Information to Tokens 

Including more information in tokens allows the 'Good Parties' 
folder greater scope to do things such as classify e-mail into those e- 
mails relating to business, friendships, private matters etc. Good tokens 
when examined will cause e-mail to be deposited into the 'Good Parties' 
folder although further information such as e-mail classification by type 
or importance/priority is also possible and the e-mails could be 
deposited automatically into sub- folders within the 'Good Parties' 
Folder. 

Integration with Internal E-mail 

Internal organisation mail, if it existed, could be managed in the 
normal way without Tokens ie. they would always be copied to the 'Good 
Parties' folder and perhaps coloured or highlighted in a way to show that 
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they did not have an associated token so that the usual token related 
functions were unavailable for those pieces of e-mail. They could of 
course be copied into an internal e-mail 'fbldetr if ' helpful 1 
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CLAIMS, 

1. An access controller for a data store, said access controller being 
cooper^ble with means instantiable. to send, messages, across a network to a 
plurality of clients . and .means instantiable to receive messages from said 
clients across, said ^network, .said access . controller , including: 

means instantiable to generate a token indicative of the number of 
times ..a .client can ..access said. data_ store; .and,, 

-rJzir, :\\~ \ 35/: - v i l 'A: zo ~ "z JcvLcr.'Z bias ?.:izv:Z .vr 6^ -■ 

authenticating means instantiable to validate, any . token included in 

a message from a. client to allow or de^y access to said data store. 

2j. An access .controller as u claimed in claim 1 wherein said token 
generating means is ^adapted to generate , tokens of .types _ indicative of the 
number of times said client is allowed to access . to said data store. 

.3. . An access controller as claimed in claim 2 wherein said token 
comprises an array attribute and said token generating means comprises 
means for populating said array with one or more prime numbers,, 

4 % > An access.' controller as claimed in, ciaim^ 2 wherein said token 
comprises a date and time attribute and said token generating means 
comprises means for populating said attribute with the date~aiid time said 
token is generated. . . 

5. An access controller as claimed in claim 2. wherein said" token 
generating means includes means for digitally signing and encrypting said 
token, and said token . authenticating mean? includes means for decrypting 
and .verifying the signature . of . a token. 

6. An access . controller as claimed in* claim 3 wherein said populating 
means comprises means for persistently storing a product of prime numbers 
(X) , means for persistently storing the number of tokens generated (i) , 
means for acquiring an ith prime number (P) , and means for acquiring the 
type of token to be generated (2), said populating means being responsive 
to 2 indicating a token allowing unlimited access to populate said array 
with a negatively signed ith prime number (-P[i]>, and responsive to z 
indicating an n-time token, where n is an integer number, to populate 
said array with a series of ith to i+nth prime numbers, and being further 
adapted to multiply said product of prime numbers (X) by each prime 
number with which a. token is. populated. 

7. An access controller as claimed in claim S wherein said 
authenticating means includes means for checking a prime number and is 
responsive to a token including a positive prime number by which said 
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product of primes (X) is divisible, to divide said product of primes by 
said prime and to allow access to said data store. 

8. ■"' An access controller Sis' claimed in claim" '6 "wherein said" 
5 authenticating" means includes means for checking a prime number arid is 

responsive to* a "token including a negative prime "number by which "s'a id 
product of primes (X) is divisible, to allow access to said data store. 

9- An access control ler~ as "claimed"* In claim iJ 8 i7 wtierefri "said controller 
10 is adapted to divide said product of primes (X) by a negative prime 

number ' Included' ih^me^ Unlimited access to said 

data" store to' revoke" sa"i<i Clients access to "said'" data "s~tore\ 

10. ' An 'access" control ler" as*" claimed" in "claim *f 'wherein said means for 
15 . sendlncT'and "receiving " messages Is" a mail cfxerit "and said ""data 'store is 

said mail client* iri : &ox~ J ~ ' -■" ■ 

11. A mail client including the access controller of claim 2, said mail 
client Including" ah ih -box* Into * which incoming* messages are s tbVed and an 

20 address book including a plurality of "client ""address "obj ects, eacST ob j ect 

including a token attribute, said mail client being adapted to set said 
'attribute for a sender* client 'wheh^a message " including 'a'tofcen is ""V 
received "from said, sender" client*". ° * "/ " [' " " 



25 12. A mail client as claimed in claim 11, said "mail client being, 

adapted to include^ a token stored in a client address object in messages 
"to fee** sent' to said* client /' ' ' ** ' * ' ** * n " ' \ 

13'*" A rhail client * as " claimed iii claim 11; ' laid mail client being 
30 responsive to user selection of ' a client from* said in-box or said address 

book to cause said token generation means to generate a token of a given 
' type and to mail said token~ to said selected client. 

14. A mail client as claimed in claim 11 wherein said in-box is divided 
35 into* a plurality of folders, said mail client being responsive to 

messages without tokens being received from a sender for a first time to 
place said messages in a New Parties folder, responsive to messages 
without tokens being received from a sender subsequent times to place 
said messages, in a Bad Parties folder, responsive to messages with valid 
40 tokens being received from a sender to place said messages in a Good 

Parties folder and responsive to messages with invalid tokens being 
received from a sender to place said messages in said Bad Parties folder. 

15. A mail client as claimed in claim 14 wherein said client is 

45 responsive to messages received from clients in the same organisation as 

the mail client to place said messages in said Good Parties folder. 
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16. A method of controlling, access to a data store comprising the steps 
of : 

cc;:-' r -genera ting - a- token indicative of the number of times : a client can 
access said data store; and 

validating any token included in a message from a-plient to allow 
or deny access to said data store. v -- * •w-m 'vY ■ -v 

17 . A computer program product comprising computer ^o^r^^.cpde s.tored 
.on. a~ compu ter~r&adabXe~starage~ medium— lo-r-r— whiea-exeeuted- en--a- computer-* 

controlling ?S.J data^^tore, ; i££li^/fcro&ram£ code^'col^riiing:^an' ' access 

control component as claimed in claim.. l* rV . . ^ ., . ,~. r r - 
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